Low Severity
Published: Nov 5, 2026
Evidence-based SBOM vulnerability matching, license policy checks, JS/TS static analysis and customer Word reports
# SecuLens
[English](README.md) | [日本語](README.jp.md)
SecuLens is a TypeScript security assessment CLI and library. It reads SPDX and CycloneDX SBOMs, independently matches component versions against OSV advisory records, evaluates license policies, reviews JavaScript/TypeScript syntax trees, and writes customer-facing Word reports.
**Version 1.1.0.** Findings are evidence for review, not a guarantee of security or legal compliance. The independent Python implementation is available at https://github.com/masahiroid/seculens-python; the independent [PHP implementation](https://github.com/masahiroid/seculens-php) is also available.
## Interactive wizard
Run `seculens` with no arguments to start interactive setup. English is the default: press Enter at the language prompt, or type `ja` for Japanese. Use `seculens wizard --lang ja` to open Japanese setup directly.
```sh
seculens
# or
seculens wizard --lang ja
```
Choose an existing SBOM assessment or SBOM generation, then supply the requested paths and options. Assessment asks for a local OSV snapshot or explicit OSV fetching, an optional license policy and source directory, customer / target / preparer, report style, output directory and findings exit policy. Customer report layout is the wizard default. Review the settings and confirm to start. EOF or choosing `n` at the final prompt cancels; Ctrl+C interrupts. OSV fetching sends package names and ecosystems; the wizard displays this before execution.
## Install
Requires Node.js 22 or later and npm.
```sh
npm install -g seculens
seculens --help
```
Release archives are also available from [GitHub releases](https://github.com/masahiroid/seculens/releases).
## Assess an existing SBOM
Offline assessment with a local OSV JSON snapshot:
```sh
seculens scan sbom.json --db database.json --policy policy.json \
--customer 'Example Customer' --lang ja --output reports
```
Download candidate advisories and match locally:
```sh
seculens scan sbom.json --fetch-o
```